You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Fix typos,config paths in kubelet-in-userns.md. Add link to port forwarder implementation (#30410)
* kubelet-in-userns.md: fix typoes
Signed-off-by: Akihiro Suda <[email protected]>
* kubelet-in-userns.md: fix unexpected config paths
Referring to `/etc/containerd/config.toml` makes sense only when the user has
read/write permissions to `/etc/containerd/config.toml` in the current mount
namespace, which is not always assumed in the context of this documentation.
The same applies to `/etc/crio/crio.conf`, too.
Partially revert PR 30020.
Signed-off-by: Akihiro Suda <[email protected]>
* kubelet-in-userns.md: add back the link to example port forwarder implementation
Add back the link to `k3s/pkg/rootlessports/controller.go` removed in PR 30020.
As stated in `{{ <note> }}`, the corresponding section is written for developers
of Kubernetes distros, not for end users.
So we should retain the implementation details here.
Partially revert PR 30020.
Signed-off-by: Akihiro Suda <[email protected]>
Copy file name to clipboardExpand all lines: content/en/docs/tasks/administer-cluster/kubelet-in-userns.md
+9-4Lines changed: 9 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,7 +14,7 @@ without root privileges, by using a {{< glossary_tooltip text="user namespace" t
14
14
This technique is also known as _rootless mode_.
15
15
16
16
{{< note >}}
17
-
This document describes how to run Kubernetes Node components (and hence pods) a non-root user.
17
+
This document describes how to run Kubernetes Node components (and hence pods) as a non-root user.
18
18
19
19
If you are just looking for how to run a pod as a non-root user, see [SecurityContext](/docs/tasks/configure-pod-container/security-context/).
20
20
{{< /note >}}
@@ -141,6 +141,7 @@ the host with an external port forwarder, such as RootlessKit, slirp4netns, or
141
141
You can use the port forwarder from K3s.
142
142
See [Running K3s in Rootless Mode](https://rancher.com/docs/k3s/latest/en/advanced/#known-issues-with-rootless-mode)
143
143
for more details.
144
+
The implementation can be found in [the `pkg/rootlessports` package](https://github.com/k3s-io/k3s/blob/v1.22.3+k3s1/pkg/rootlessports/controller.go) of k3s.
144
145
145
146
### Configuring CRI
146
147
@@ -152,8 +153,7 @@ containerd or CRI-O and ensure that it is running within the user namespace befo
152
153
153
154
Running CRI plugin of containerd in a user namespace is supported since containerd 1.4.
154
155
155
-
Running containerd within a user namespace requires the following configurations
156
-
in `/etc/containerd/containerd-config.toml`.
156
+
Running containerd within a user namespace requires the following configurations.
157
157
158
158
```toml
159
159
version = 2
@@ -176,14 +176,17 @@ version = 2
176
176
SystemdCgroup = false
177
177
```
178
178
179
+
The default path of the configuration file is `/etc/containerd/config.toml`.
180
+
The path can be specified with `containerd -c /path/to/containerd/config.toml`.
181
+
179
182
{{% /tab %}}
180
183
{{% tab name="CRI-O" %}}
181
184
182
185
Running CRI-O in a user namespace is supported since CRI-O 1.22.
183
186
184
187
CRI-O requires an environment variable `_CRIO_ROOTLESS=1` to be set.
185
188
186
-
The following configurations (in `/etc/crio/crio.conf`) are also recommended:
189
+
The following configurations are also recommended:
187
190
188
191
```toml
189
192
[crio]
@@ -197,6 +200,8 @@ The following configurations (in `/etc/crio/crio.conf`) are also recommended:
197
200
cgroup_manager = "cgroupfs"
198
201
```
199
202
203
+
The default path of the configuration file is `/etc/crio/crio.conf`.
204
+
The path can be specified with `crio --config /path/to/crio/crio.conf`.
0 commit comments